Cold Email Deliverability: The 2026 Checklist

Cold email deliverability is not luck. In 2026, with Google, Yahoo, and Microsoft all enforcing sender authentication for bulk senders, it comes down to a set of guardrails you apply every time. Miss them and your email does not land in spam. It gets rejected before a human ever sees it. Here is the checklist.

1. Authentication is non-negotiable

All three major providers enforce this now. Skip it and your mail bounces.

SPF is a DNS record listing which servers may send for your domain. DKIM is a cryptographic signature proving the message was not altered in transit; Gmail has required it since February 2024. DMARC tells receivers what to do when SPF or DKIM fails. Start at p=none, then move to p=quarantine or p=reject as your reputation builds. Gmail now permanently rejects mail from senders with no DMARC record at all. Google publishes the full rules in its email sender guidelines.

If you do nothing else on this list, do this.

2. Never send from your primary domain

If your company runs on acme.com, register secondary domains like getacme.com or tryacme.com and send from those. A deliverability incident on a secondary domain is recoverable. The same incident on your primary takes your corporate email and your reputation down with it.

3. Warm every domain and mailbox

Warm new domains for at least two weeks before any real volume. Warmup gradually builds reputation by simulating natural engagement, so providers learn to trust the domain. Skipping it is the fastest way to start your campaign in the spam folder.

4. Cap volume and ramp slowly

Most teams run three to five warmed mailboxes to grow total volume while keeping each mailbox low. Push past roughly 100 per mailbox per day and you start tripping filters and burning reputation.

5. Verify every list

List verification is not optional. Run every address through a verifier (NeverBounce, ZeroBounce, MillionVerifier) before you load it. This strips invalid addresses, catch-all domains, and known spam traps. Sending to an unverified list is one of the quickest ways to wreck your reputation. Keep bounce rate under three percent.

6. Keep the content simple

Write in plain text or very light HTML. No header images, no background colors, no font circus. Use standard sizes and black text. Never attach files, because attachments trip filters and tank placement. Be careful with open tracking too: it can raise spam likelihood, and Gmail now flags tracked mail to the recipient.

7. Watch the complaint threshold

Google asks bulk senders (5,000 or more a day to Gmail) to keep spam complaint rate under 0.3 percent. That is three complaints per thousand emails. Cross it and enforcement can block your domain from Gmail inboxes entirely. The best defense against complaints is relevance. Email people actually want gets replies, not reports.

8. Personalize to earn engagement

Average cold email reply rate sits around 3.4 percent. Signal-based, personalized campaigns hit 15 to 25 percent, roughly a 5x jump. More replies and fewer complaints is exactly the engagement pattern that keeps you in the inbox over time. Personalization is a deliverability tactic, not just a copywriting one. It starts with targeting, which is why a sharp ICP does more for deliverability than any subject-line trick.

The 2026 deliverability checklist

• SPF, DKIM, DMARC configured (DMARC at least p=none)
• Sending only from secondary domains
• Every domain warmed two or more weeks
• 30 sends per mailbox per day to start, ramped slowly
• Three to five mailboxes for volume
• Every list verified; bounce rate under three percent
• Plain-text-style content, no attachments
• Spam complaint rate under 0.3 percent
• Personalized, signal-based messaging
• Auto-pause on reply and on rising bounce or complaint rates

Let the system enforce it

Most of this should not be manual. Indeel applies these guardrails by default, sending from secondary domains with warmup and send caps, and it watches bounce and complaint rates continuously, pausing sends before a problem turns into a blocklist. You write the message; the infrastructure stays out of trouble.

Choosing a sender to run all this through? Our neutral Instantly vs Smartlead comparison helps, though as this checklist shows, the setup matters far more than the brand. And if you would rather not run deliverability as a separate job at all, see how it fits into the all-in-one engine.

FAQ

Why are my cold emails going to spam? Usually one of these: missing DMARC, no warmup, sending from your primary domain, unverified lists, or volume ramped too fast. Work down this checklist in order.

How many emails can I send per day safely? Start near 30 per mailbox and ramp toward 50 to 100 over a few weeks. Scale with more warmed mailboxes, not higher per-mailbox volume.

Do I need separate domains for cold email? Yes. Always send from secondary domains, never your primary.

Want the guardrails on by default? See how Indeel handles deliverability.